Trusted CA Indication extension
E893549
The Trusted CA Indication extension is a Transport Layer Security (TLS) mechanism that lets a client signal which certificate authorities it trusts so the server can select an appropriate certificate chain.
All labels observed (1)
| Label | Occurrences |
|---|---|
| Trusted CA Indication extension canonical | 2 |
How this entity was disambiguated
This entity first appeared as the object of triple T10926995 — resolving that mention is where its identity was fixed. The disambiguator weighed these candidate entities and picked the highlighted one (or “None”, minting a new entity). This is how homonymy is resolved: the same surface form can point to different entities.
NED1
Entity disambiguation (via context triple)
gpt-5-mini-2025-08-07
Target entity: Trusted CA Indication extension Context triple: [RFC 6066, defines, Trusted CA Indication extension]
-
A.
Client Certificate URL extension
The Client Certificate URL extension is a Transport Layer Security (TLS) mechanism that allows a client to provide a URL from which its certificate can be retrieved, rather than sending the certificate directly in the handshake.
-
B.
OCSP
OCSP (Online Certificate Status Protocol) is an internet protocol used to obtain the real-time revocation status of digital certificates in public key infrastructures.
-
C.
Server Name Indication extension
The Server Name Indication (SNI) extension is a TLS protocol feature that allows a client to indicate the hostname it is trying to connect to at the start of the handshake so that the server can present the correct certificate for virtual hosting.
-
D.
Certificate Enrollment Web Service
Certificate Enrollment Web Service is a Windows server role service that enables certificate enrollment and renewal over HTTPS, typically used with Active Directory Certificate Services to support remote and policy-based certificate requests.
-
E.
DST Root CA X3
DST Root CA X3 is a widely trusted root certificate authority operated by IdenTrust that historically provided the cross-signed trust anchor enabling broad browser compatibility for Let’s Encrypt certificates.
- F. None of above. chosen
- G. Unsure - the case is ambiguous/there is not enough information to decide.
NED2
Entity disambiguation (via description)
gpt-5-mini-2025-08-07
Target entity: Trusted CA Indication extension Target entity description: The Trusted CA Indication extension is a Transport Layer Security (TLS) mechanism that lets a client signal which certificate authorities it trusts so the server can select an appropriate certificate chain.
-
A.
Client Certificate URL extension
The Client Certificate URL extension is a Transport Layer Security (TLS) mechanism that allows a client to provide a URL from which its certificate can be retrieved, rather than sending the certificate directly in the handshake.
-
B.
OCSP
OCSP (Online Certificate Status Protocol) is an internet protocol used to obtain the real-time revocation status of digital certificates in public key infrastructures.
-
C.
Server Name Indication extension
The Server Name Indication (SNI) extension is a TLS protocol feature that allows a client to indicate the hostname it is trying to connect to at the start of the handshake so that the server can present the correct certificate for virtual hosting.
-
D.
Certificate Enrollment Web Service
Certificate Enrollment Web Service is a Windows server role service that enables certificate enrollment and renewal over HTTPS, typically used with Active Directory Certificate Services to support remote and policy-based certificate requests.
-
E.
DST Root CA X3
DST Root CA X3 is a widely trusted root certificate authority operated by IdenTrust that historically provided the cross-signed trust anchor enabling broad browser compatibility for Let’s Encrypt certificates.
- F. None of above. chosen
Statements (32)
| Predicate | Object |
|---|---|
| instanceOf |
TLS extension
ⓘ
Transport Layer Security mechanism ⓘ |
| abbreviation | TCI ⓘ |
| assumes | server has certificates issued by multiple CAs or chains ⓘ |
| benefit |
can reduce handshake size in multi-CA environments
ⓘ
enables better certificate selection for clients with constrained trust stores ⓘ reduces need for servers to send multiple certificate chains ⓘ |
| category | TLS certificate selection optimization ⓘ |
| direction | client hello extension ⓘ |
| granularity | CA-level trust indication ⓘ |
| influences |
server choice of end-entity certificate
ⓘ
server choice of intermediate CA certificates ⓘ |
| inputFrom | client trust store ⓘ |
| layer | application layer security protocol ⓘ |
| operatesOn | list of trusted certificate authorities ⓘ |
| outputTo | server certificate selection logic ⓘ |
| protocol |
Transport Layer Security
ⓘ
linked to:
TLS
|
| purpose |
to help a TLS server select an appropriate certificate chain
ⓘ
to let a TLS client indicate which certificate authorities it trusts ⓘ |
| relatedTo |
Server Name Indication extension
ⓘ
TLS certificate chain ⓘ X.509 public key infrastructure ⓘ
linked to:
X.509 certificates
certificate authorities ⓘ |
| role | client-to-server signaling mechanism ⓘ |
| scope | TLS handshake phase ⓘ |
| securityProperty | does not itself provide confidentiality or integrity but influences certificate choice ⓘ |
| status | proposed TLS extension ⓘ |
| useCase |
IoT or embedded clients with restricted trust anchors
ⓘ
enterprise environments with private and public CAs ⓘ hosting providers serving certificates from different CAs ⓘ |
| usedBy |
TLS clients
ⓘ
TLS servers ⓘ |
How these facts were elicited
The pipeline generated the facts above by prompting gpt-5.1 with this entity's name + description and the instruction below.
Instruction
You are a knowledge base construction expert. Given a subject entity and a description of it, return factual statements that you know for the subject as a JSON list of dictionaries(triples), where keys must be "subject", "predicate" and "object". The number of facts may be very high, between 25 to 50 or more, for very popular subjects. For less popular subjects, the number of facts can be very low, like 5 or 10. # Requirements - If you don't know the subject at all, return an empty list. - If the subject is not a named entity, return an empty list. - Include at least one triple where predicate is "instanceOf". - Do not get too wordy. - Separate several objects into multiple triples with one object.
Input
Subject: Trusted CA Indication extension Description of subject: The Trusted CA Indication extension is a Transport Layer Security (TLS) mechanism that lets a client signal which certificate authorities it trusts so the server can select an appropriate certificate chain.
Referenced by (2)
Full triples — surface form annotated when it differs from this entity's canonical label.